jaffacakes118_Trojan-Downloader[.]Win32[.]Qoologic[.]ad[.]41056bbef609e66d27b293f9ac1717b3

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_Trojan-Downloader.Win32.Qoologic.ad.41056bbef609e66d27b293f9ac1717b3
Size 206KB
Sample261006-pc65csxz4m
SHA256 26e6c0931517c370b0847c75642fcdaadc1ac0e54f216819c279d41e937533a1
MD5 41056bbef609e66d27b293f9ac1717b3
SHA1 3f4f080514d11483f936c6ee4b5d0202880a8ee2
SHA512 8e1abea84ccf7e14121ac1b804314dfd11e4213c91e48b5b41bb951ed9812d9226f4e74e9df0c3af807aee04c78e96c49a4bf01a16073a3c91cbea0f4176d373
SSDEEP 6144:B+rnv69/8NDflRV9Wj+yUcA9RJ0XxvtSu:YryhkfSj+yUtw/
TLSH
T19824E157BD80C8BBCCC68A7002E49E16EB77C13155F0C117DAB4499EBCA7A64693E387
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
jaffacakes118_Trojan-Downloader.Win32.Qoologic.ad.41056bbef609e66d27b293f9ac1717b3

File Explorer

jaffacakes118_Trojan-Downloader.Win32.Qoologic.ad.41056bbef609e66d27b293f9ac1717b3

.exe 206KB

jaffacakes118_Trojan-Downloader.Win32.Qoologic.ad.41056bbef609e66d27b293f9ac1717b3

IMPHASH 900a759ebd008c767b0c495ad1df8cc1
SHA256 26e6c0931517c370b0847c75642fcdaadc1ac0e54f216819c279d41e937533a1
MD5 41056bbef609e66d27b293f9ac1717b3
SHA1 3f4f080514d11483f936c6ee4b5d0202880a8ee2
SHA512 8e1abea84ccf7e14121ac1b804314dfd11e4213c91e48b5b41bb951ed9812d9226f4e74e9df0c3af807aee04c78e96c49a4bf01a16073a3c91cbea0f4176d373
SSDEEP 6144:B+rnv69/8NDflRV9Wj+yUcA9RJ0XxvtSu:YryhkfSj+yUtw/
TLSH
T19824E157BD80C8BBCCC68A7002E49E16EB77C13155F0C117DAB4499EBCA7A64693E387
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

71:72:60:64:d8:d0:d6:6e:36:3d:c9:f5:26:10:b4:c3:40:ff:38:63

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Qool Aid\, LLC,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Qool Aid\, LLC,L=Newport Beach,ST=California,C=US

Chains

Aug 17, 2005

CN=Qool Aid\, LLC,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Qool Aid\, LLC,L=Newport Beach,ST=California,C=US

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Serial Number

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Timespan

Jan 29, 1996 - Aug 1, 2028

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Serial Number

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2008

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Serial Number

57:64:6e:2b:55:00:23:d4:90:53:4a:55:3e:ab:0d:0a

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Jul 16, 2004 - Jul 15, 2009

Subject

CN=Qool Aid\, LLC,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Qool Aid\, LLC,L=Newport Beach,ST=California,C=US

Serial Number

22:b4:68:ff:bb:80:c3:ba:7a:f0:73:b5:3e:48:1f:30

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 27, 2005 - Jun 27, 2006

Minor OS version

Major OS version

Entry point

15197

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

shlwapi

StrStrA StrChrA StrNCatA StrToIntA StrStrIA wnsprintfA

iphlpapi

GetAdaptersInfo

rasapi32

RasEnumEntriesA

kernel32

QueryPerformanceCounter GetSystemInfo GetStringTypeA GetSystemTimeAsFileTime SetStdHandle FlushFileBuffers GetLocaleInfoA VirtualProtect lstrlenA lstrcpynA lstrcatA HeapFree CloseHandle WriteFile SetFilePointer ReadFile HeapAlloc GetProcessHeap CreateFileA GetWindowsDirectoryA GetShortPathNameA MoveFileExA lstrcmpA lstrcpyA lstrcmpiA DeleteFileA GetSystemDirectoryA GetProcAddress LoadLibraryA LockResource SizeofResource LoadResource FindResourceA SetFileAttributesA SetFileTime GetFileTime VirtualQuery GetTickCount GetVolumeInformationA WideCharToMultiByte GetVersionExA FindClose FindFirstFileA CreateToolhelp32Snapshot Process32Next Process32First HeapReAlloc GetCurrentThreadId GetCurrentProcessId Sleep GetLastError HeapDestroy HeapCreate LCMapStringW GetComputerNameA UnmapViewOfFile MapViewOfFile CreateFileMappingA GlobalMemoryStatus FindNextFileA DeviceIoControl ExitProcess GetModuleFileNameA GetTempPathA GetModuleHandleA TerminateProcess GetCurrentProcess GetStartupInfoA GetCommandLineA RtlUnwind InterlockedExchange VirtualFree VirtualAlloc GetStdHandle UnhandledExceptionFilter FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType HeapSize GetACP GetOEMCP GetCPInfo LCMapStringA MultiByteToWideChar GetStringTypeW

user32

wsprintfA FindWindowA

advapi32

RegEnumKeyExA RegQueryValueExA RegQueryValueA RegCreateKeyExA GetUserNameA RegEnumValueA RegQueryInfoKeyA RegCloseKey RegOpenKeyA RegSetValueExA RegCreateKeyA RegOpenKeyExA

shell32

ShellExecuteA

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_Trojan-Downloader.Win32.Qoologic.ad.41056bbef609e66d27b293f9ac1717b3

PE Signature issue

shlwapi

iphlpapi

rasapi32

kernel32

user32

advapi32

shell32

generic